octoflow-core 1.0.0

package/dist/adapters/agents/selection-backend-checks.js

@@ -0,0 +1,194 @@
+import { API_KEY_ENV, getApiKey } from "../../utils/api-keys.js";
+import { CustomApiClient } from "./custom-api-client.js";
+import { CustomCliClient } from "./custom-cli-client.js";
+import { OllamaClient } from "./ollama/index.js";
+import { createBackendRegistry, getBackendType } from "./selection-registry.js";
+import { VercelAiClient } from "./vercel-client.js";
+async function checkVercelBackend(name, apiKeys, authStore) {
+  const apiKey = getApiKey(name, apiKeys, authStore);
+  const provider = name.replace("vercel-ai:", "");
+  const client = new VercelAiClient({ provider, apiKey: apiKey ?? "" });
+  const info = typeof client.info === "function" ? client.info() : void 0;
+  if (!apiKey) {
+    return {
+      backend: name,
+      backendType: "sdk",
+      ready: false,
+      reason: `${API_KEY_ENV[name] ?? "API key"} not set`,
+      version: null,
+      info
+    };
+  }
+  try {
+    await import("ai");
+    return {
+      backend: name,
+      backendType: "sdk",
+      ready: true,
+      reason: null,
+      version: null,
+      info
+    };
+  } catch {
+    return {
+      backend: name,
+      backendType: "sdk",
+      ready: false,
+      reason: "`ai` package is not installed",
+      version: null,
+      info
+    };
+  }
+}
+async function checkOllamaBackend(apiKeys, authStore) {
+  try {
+    const client = new OllamaClient({
+      apiKey: getApiKey("ollama", apiKeys, authStore)
+    });
+    const version = await client.getVersion();
+    const info = typeof client.info === "function" ? client.info() : void 0;
+    return {
+      backend: "ollama",
+      backendType: "local",
+      ready: Boolean(version),
+      reason: version ? null : "Ollama is not reachable at the configured host",
+      version,
+      info
+    };
+  } catch (error) {
+    return {
+      backend: "ollama",
+      backendType: "local",
+      ready: false,
+      reason: error instanceof Error ? error.message : String(error),
+      version: null
+    };
+  }
+}
+async function checkBuiltInBackend(name, apiKeys, registry, authStore, options) {
+  try {
+    const backendType = getBackendType(name);
+    const reg = registry ?? createBackendRegistry(apiKeys, authStore);
+    const backend = reg.get(name);
+    if (!backend) {
+      return {
+        backend: name,
+        backendType,
+        ready: false,
+        reason: "Unknown backend",
+        version: null
+      };
+    }
+    const info = typeof backend.info === "function" ? backend.info() : void 0;
+    if (backendType === "cli" && options?.skipInstallCheck) {
+      return {
+        backend: name,
+        backendType,
+        ready: true,
+        reason: null,
+        version: null,
+        info
+      };
+    }
+    const ready = await backend.isInstalled();
+    const version = ready ? await backend.getVersion() : null;
+    const envKey = API_KEY_ENV[name];
+    const reason = ready ? null : envKey ? `${backend.displayName} is not ready; install the backend or set ${envKey}` : `${backend.displayName} is not installed`;
+    return {
+      backend: name,
+      backendType,
+      ready,
+      reason,
+      version,
+      info
+    };
+  } catch (error) {
+    return {
+      backend: name,
+      backendType: getBackendType(name),
+      ready: false,
+      reason: error instanceof Error ? error.message : String(error),
+      version: null
+    };
+  }
+}
+async function checkCustomApiBackend(options) {
+  if (!options.customApi?.url) {
+    return {
+      backend: "custom-api",
+      backendType: "api",
+      ready: false,
+      reason: "custom-api backend requires `customApi.url` in bridge options",
+      version: null
+    };
+  }
+  try {
+    const client = new CustomApiClient(options.customApi);
+    const ready = await client.isReady();
+    const info = typeof client.info === "function" ? client.info() : void 0;
+    return {
+      backend: "custom-api",
+      backendType: "api",
+      ready,
+      reason: ready ? null : "Custom API endpoint is not reachable",
+      version: null,
+      ...info ? { info } : {}
+    };
+  } catch (error) {
+    return {
+      backend: "custom-api",
+      backendType: "api",
+      ready: false,
+      reason: error instanceof Error ? error.message : String(error),
+      version: null
+    };
+  }
+}
+async function checkCustomCliBackend(options) {
+  if (!options.customCli?.command) {
+    return {
+      backend: "custom",
+      backendType: "cli",
+      ready: false,
+      reason: "custom backend requires `customCli.command` in bridge options",
+      version: null
+    };
+  }
+  try {
+    const client = new CustomCliClient({
+      ...options.customCli,
+      skipInstallCheck: true
+    });
+    const ready = await client.isReady();
+    const info = typeof client.info === "function" ? await client.info() : void 0;
+    return {
+      backend: "custom",
+      backendType: "cli",
+      ready,
+      reason: ready ? null : `Custom CLI binary "${options.customCli.command}" is not on PATH`,
+      version: null,
+      ...info ? { info } : {}
+    };
+  } catch (error) {
+    return {
+      backend: "custom",
+      backendType: "cli",
+      ready: false,
+      reason: error instanceof Error ? error.message : String(error),
+      version: null
+    };
+  }
+}
+async function checkBackend(name, apiKeys, registry, authStore, options) {
+  if (name === "ollama") return checkOllamaBackend(apiKeys, authStore);
+  if (name.startsWith("vercel-ai:")) {
+    return checkVercelBackend(name, apiKeys, authStore);
+  }
+  if (name === "custom-api") return checkCustomApiBackend(options ?? {});
+  if (name === "custom") return checkCustomCliBackend(options ?? {});
+  return checkBuiltInBackend(name, apiKeys, registry, authStore, options);
+}
+export {
+  checkBackend
+};
+//# sourceMappingURL=selection-backend-checks.js.map

package/dist/adapters/agents/selection-backend-checks.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../src/adapters/agents/selection-backend-checks.ts"],
+  "sourcesContent": ["/**\n * Backend readiness probes used during selection and health checks.\n */\n\nimport type { AuthStore } from '../../auth/types.js';\nimport type { BackendName } from '../../domain/core-client.js';\nimport type { BackendInfo, BackendType } from '../../domain/protocol.js';\nimport { API_KEY_ENV, getApiKey } from '../../utils/api-keys.js';\nimport type { BackendRegistry } from './backends/index.js';\nimport { CustomApiClient } from './custom-api-client.js';\nimport { CustomCliClient } from './custom-cli-client.js';\nimport { OllamaClient } from './ollama/index.js';\nimport type { BackendSelectionOptions } from './selection.js';\nimport { createBackendRegistry, getBackendType } from './selection-registry.js';\nimport { VercelAiClient, type VercelProvider } from './vercel-client.js';\n\ninterface BackendCheckResult {\n  backend: BackendName;\n  backendType: BackendType;\n  ready: boolean;\n  reason: string | null;\n  version: string | null;\n  /** RFC-16: self-describing snapshot, when the checker can derive one. */\n  info?: BackendInfo;\n}\n\nasync function checkVercelBackend(\n  name: BackendName,\n  apiKeys: Partial<Record<BackendName, string>>,\n  authStore?: AuthStore\n): Promise<BackendCheckResult> {\n  const apiKey = getApiKey(name, apiKeys, authStore);\n  const provider = name.replace('vercel-ai:', '') as VercelProvider;\n  const client = new VercelAiClient({ provider, apiKey: apiKey ?? '' });\n  const info: BackendInfo | undefined =\n    typeof client.info === 'function' ? client.info() : undefined;\n  if (!apiKey) {\n    return {\n      backend: name,\n      backendType: 'sdk',\n      ready: false,\n      reason: `${API_KEY_ENV[name] ?? 'API key'} not set`,\n      version: null,\n      info,\n    };\n  }\n  try {\n    await import('ai');\n    return {\n      backend: name,\n      backendType: 'sdk',\n      ready: true,\n      reason: null,\n      version: null,\n      info,\n    };\n  } catch {\n    return {\n      backend: name,\n      backendType: 'sdk',\n      ready: false,\n      reason: '`ai` package is not installed',\n      version: null,\n      info,\n    };\n  }\n}\n\nasync function checkOllamaBackend(\n  apiKeys: Partial<Record<BackendName, string>>,\n  authStore?: AuthStore\n): Promise<BackendCheckResult> {\n  try {\n    const client = new OllamaClient({\n      apiKey: getApiKey('ollama', apiKeys, authStore),\n    });\n    const version = await client.getVersion();\n    const info = typeof client.info === 'function' ? client.info() : undefined;\n    return {\n      backend: 'ollama',\n      backendType: 'local',\n      ready: Boolean(version),\n      reason: version ? null : 'Ollama is not reachable at the configured host',\n      version,\n      info,\n    };\n  } catch (error) {\n    return {\n      backend: 'ollama',\n      backendType: 'local',\n      ready: false,\n      reason: error instanceof Error ? error.message : String(error),\n      version: null,\n    };\n  }\n}\n\nasync function checkBuiltInBackend(\n  name: BackendName,\n  apiKeys: Partial<Record<BackendName, string>>,\n  registry?: BackendRegistry,\n  authStore?: AuthStore,\n  options?: Pick<BackendSelectionOptions, 'skipInstallCheck'>\n): Promise<BackendCheckResult> {\n  try {\n    const backendType = getBackendType(name);\n    const reg = registry ?? createBackendRegistry(apiKeys, authStore);\n    const backend = reg.get(name);\n    if (!backend) {\n      return {\n        backend: name,\n        backendType,\n        ready: false,\n        reason: 'Unknown backend',\n        version: null,\n      };\n    }\n    const info =\n      typeof backend.info === 'function' ? backend.info() : undefined;\n    if (backendType === 'cli' && options?.skipInstallCheck) {\n      return {\n        backend: name,\n        backendType,\n        ready: true,\n        reason: null,\n        version: null,\n        info,\n      };\n    }\n    const ready = await backend.isInstalled();\n    const version = ready ? await backend.getVersion() : null;\n    const envKey = API_KEY_ENV[name];\n    const reason = ready\n      ? null\n      : envKey\n        ? `${backend.displayName} is not ready; install the backend or set ${envKey}`\n        : `${backend.displayName} is not installed`;\n    return {\n      backend: name,\n      backendType,\n      ready,\n      reason,\n      version,\n      info,\n    };\n  } catch (error) {\n    return {\n      backend: name,\n      backendType: getBackendType(name),\n      ready: false,\n      reason: error instanceof Error ? error.message : String(error),\n      version: null,\n    };\n  }\n}\n\nasync function checkCustomApiBackend(\n  options: Pick<BackendSelectionOptions, 'customApi'>\n): Promise<BackendCheckResult> {\n  if (!options.customApi?.url) {\n    return {\n      backend: 'custom-api',\n      backendType: 'api',\n      ready: false,\n      reason: 'custom-api backend requires `customApi.url` in bridge options',\n      version: null,\n    };\n  }\n  try {\n    const client = new CustomApiClient(options.customApi);\n    const ready = await client.isReady();\n    const info = typeof client.info === 'function' ? client.info() : undefined;\n    return {\n      backend: 'custom-api',\n      backendType: 'api',\n      ready,\n      reason: ready ? null : 'Custom API endpoint is not reachable',\n      version: null,\n      ...(info ? { info } : {}),\n    };\n  } catch (error) {\n    return {\n      backend: 'custom-api',\n      backendType: 'api',\n      ready: false,\n      reason: error instanceof Error ? error.message : String(error),\n      version: null,\n    };\n  }\n}\n\nasync function checkCustomCliBackend(\n  options: Pick<BackendSelectionOptions, 'customCli'>\n): Promise<BackendCheckResult> {\n  if (!options.customCli?.command) {\n    return {\n      backend: 'custom',\n      backendType: 'cli',\n      ready: false,\n      reason: 'custom backend requires `customCli.command` in bridge options',\n      version: null,\n    };\n  }\n  try {\n    const client = new CustomCliClient({\n      ...options.customCli,\n      skipInstallCheck: true,\n    });\n    const ready = await client.isReady();\n    // CustomCliClient pre-seeds its backend, so `client.info()` resolves\n    // without I/O or an install check. Fall back defensively for partial clients.\n    const info =\n      typeof client.info === 'function' ? await client.info() : undefined;\n    return {\n      backend: 'custom',\n      backendType: 'cli',\n      ready,\n      reason: ready\n        ? null\n        : `Custom CLI binary \"${options.customCli.command}\" is not on PATH`,\n      version: null,\n      ...(info ? { info } : {}),\n    };\n  } catch (error) {\n    return {\n      backend: 'custom',\n      backendType: 'cli',\n      ready: false,\n      reason: error instanceof Error ? error.message : String(error),\n      version: null,\n    };\n  }\n}\n\nexport async function checkBackend(\n  name: BackendName,\n  apiKeys: Partial<Record<BackendName, string>>,\n  registry?: BackendRegistry,\n  authStore?: AuthStore,\n  options?: Pick<\n    BackendSelectionOptions,\n    'customApi' | 'customCli' | 'skipInstallCheck'\n  >\n): Promise<BackendCheckResult> {\n  if (name === 'ollama') return checkOllamaBackend(apiKeys, authStore);\n  if (name.startsWith('vercel-ai:')) {\n    return checkVercelBackend(name, apiKeys, authStore);\n  }\n  if (name === 'custom-api') return checkCustomApiBackend(options ?? {});\n  if (name === 'custom') return checkCustomCliBackend(options ?? {});\n  return checkBuiltInBackend(name, apiKeys, registry, authStore, options);\n}\n"],
+  "mappings": "AAOA,SAAS,aAAa,iBAAiB;AAEvC,SAAS,uBAAuB;AAChC,SAAS,uBAAuB;AAChC,SAAS,oBAAoB;AAE7B,SAAS,uBAAuB,sBAAsB;AACtD,SAAS,sBAA2C;AAYpD,eAAe,mBACb,MACA,SACA,WAC6B;AAC7B,QAAM,SAAS,UAAU,MAAM,SAAS,SAAS;AACjD,QAAM,WAAW,KAAK,QAAQ,cAAc,EAAE;AAC9C,QAAM,SAAS,IAAI,eAAe,EAAE,UAAU,QAAQ,UAAU,GAAG,CAAC;AACpE,QAAM,OACJ,OAAO,OAAO,SAAS,aAAa,OAAO,KAAK,IAAI;AACtD,MAAI,CAAC,QAAQ;AACX,WAAO;AAAA,MACL,SAAS;AAAA,MACT,aAAa;AAAA,MACb,OAAO;AAAA,MACP,QAAQ,GAAG,YAAY,IAAI,KAAK,SAAS;AAAA,MACzC,SAAS;AAAA,MACT;AAAA,IACF;AAAA,EACF;AACA,MAAI;AACF,UAAM,OAAO,IAAI;AACjB,WAAO;AAAA,MACL,SAAS;AAAA,MACT,aAAa;AAAA,MACb,OAAO;AAAA,MACP,QAAQ;AAAA,MACR,SAAS;AAAA,MACT;AAAA,IACF;AAAA,EACF,QAAQ;AACN,WAAO;AAAA,MACL,SAAS;AAAA,MACT,aAAa;AAAA,MACb,OAAO;AAAA,MACP,QAAQ;AAAA,MACR,SAAS;AAAA,MACT;AAAA,IACF;AAAA,EACF;AACF;AAEA,eAAe,mBACb,SACA,WAC6B;AAC7B,MAAI;AACF,UAAM,SAAS,IAAI,aAAa;AAAA,MAC9B,QAAQ,UAAU,UAAU,SAAS,SAAS;AAAA,IAChD,CAAC;AACD,UAAM,UAAU,MAAM,OAAO,WAAW;AACxC,UAAM,OAAO,OAAO,OAAO,SAAS,aAAa,OAAO,KAAK,IAAI;AACjE,WAAO;AAAA,MACL,SAAS;AAAA,MACT,aAAa;AAAA,MACb,OAAO,QAAQ,OAAO;AAAA,MACtB,QAAQ,UAAU,OAAO;AAAA,MACzB;AAAA,MACA;AAAA,IACF;AAAA,EACF,SAAS,OAAO;AACd,WAAO;AAAA,MACL,SAAS;AAAA,MACT,aAAa;AAAA,MACb,OAAO;AAAA,MACP,QAAQ,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAAA,MAC7D,SAAS;AAAA,IACX;AAAA,EACF;AACF;AAEA,eAAe,oBACb,MACA,SACA,UACA,WACA,SAC6B;AAC7B,MAAI;AACF,UAAM,cAAc,eAAe,IAAI;AACvC,UAAM,MAAM,YAAY,sBAAsB,SAAS,SAAS;AAChE,UAAM,UAAU,IAAI,IAAI,IAAI;AAC5B,QAAI,CAAC,SAAS;AACZ,aAAO;AAAA,QACL,SAAS;AAAA,QACT;AAAA,QACA,OAAO;AAAA,QACP,QAAQ;AAAA,QACR,SAAS;AAAA,MACX;AAAA,IACF;AACA,UAAM,OACJ,OAAO,QAAQ,SAAS,aAAa,QAAQ,KAAK,IAAI;AACxD,QAAI,gBAAgB,SAAS,SAAS,kBAAkB;AACtD,aAAO;AAAA,QACL,SAAS;AAAA,QACT;AAAA,QACA,OAAO;AAAA,QACP,QAAQ;AAAA,QACR,SAAS;AAAA,QACT;AAAA,MACF;AAAA,IACF;AACA,UAAM,QAAQ,MAAM,QAAQ,YAAY;AACxC,UAAM,UAAU,QAAQ,MAAM,QAAQ,WAAW,IAAI;AACrD,UAAM,SAAS,YAAY,IAAI;AAC/B,UAAM,SAAS,QACX,OACA,SACE,GAAG,QAAQ,WAAW,6CAA6C,MAAM,KACzE,GAAG,QAAQ,WAAW;AAC5B,WAAO;AAAA,MACL,SAAS;AAAA,MACT;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF,SAAS,OAAO;AACd,WAAO;AAAA,MACL,SAAS;AAAA,MACT,aAAa,eAAe,IAAI;AAAA,MAChC,OAAO;AAAA,MACP,QAAQ,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAAA,MAC7D,SAAS;AAAA,IACX;AAAA,EACF;AACF;AAEA,eAAe,sBACb,SAC6B;AAC7B,MAAI,CAAC,QAAQ,WAAW,KAAK;AAC3B,WAAO;AAAA,MACL,SAAS;AAAA,MACT,aAAa;AAAA,MACb,OAAO;AAAA,MACP,QAAQ;AAAA,MACR,SAAS;AAAA,IACX;AAAA,EACF;AACA,MAAI;AACF,UAAM,SAAS,IAAI,gBAAgB,QAAQ,SAAS;AACpD,UAAM,QAAQ,MAAM,OAAO,QAAQ;AACnC,UAAM,OAAO,OAAO,OAAO,SAAS,aAAa,OAAO,KAAK,IAAI;AACjE,WAAO;AAAA,MACL,SAAS;AAAA,MACT,aAAa;AAAA,MACb;AAAA,MACA,QAAQ,QAAQ,OAAO;AAAA,MACvB,SAAS;AAAA,MACT,GAAI,OAAO,EAAE,KAAK,IAAI,CAAC;AAAA,IACzB;AAAA,EACF,SAAS,OAAO;AACd,WAAO;AAAA,MACL,SAAS;AAAA,MACT,aAAa;AAAA,MACb,OAAO;AAAA,MACP,QAAQ,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAAA,MAC7D,SAAS;AAAA,IACX;AAAA,EACF;AACF;AAEA,eAAe,sBACb,SAC6B;AAC7B,MAAI,CAAC,QAAQ,WAAW,SAAS;AAC/B,WAAO;AAAA,MACL,SAAS;AAAA,MACT,aAAa;AAAA,MACb,OAAO;AAAA,MACP,QAAQ;AAAA,MACR,SAAS;AAAA,IACX;AAAA,EACF;AACA,MAAI;AACF,UAAM,SAAS,IAAI,gBAAgB;AAAA,MACjC,GAAG,QAAQ;AAAA,MACX,kBAAkB;AAAA,IACpB,CAAC;AACD,UAAM,QAAQ,MAAM,OAAO,QAAQ;AAGnC,UAAM,OACJ,OAAO,OAAO,SAAS,aAAa,MAAM,OAAO,KAAK,IAAI;AAC5D,WAAO;AAAA,MACL,SAAS;AAAA,MACT,aAAa;AAAA,MACb;AAAA,MACA,QAAQ,QACJ,OACA,sBAAsB,QAAQ,UAAU,OAAO;AAAA,MACnD,SAAS;AAAA,MACT,GAAI,OAAO,EAAE,KAAK,IAAI,CAAC;AAAA,IACzB;AAAA,EACF,SAAS,OAAO;AACd,WAAO;AAAA,MACL,SAAS;AAAA,MACT,aAAa;AAAA,MACb,OAAO;AAAA,MACP,QAAQ,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAAA,MAC7D,SAAS;AAAA,IACX;AAAA,EACF;AACF;AAEA,eAAsB,aACpB,MACA,SACA,UACA,WACA,SAI6B;AAC7B,MAAI,SAAS,SAAU,QAAO,mBAAmB,SAAS,SAAS;AACnE,MAAI,KAAK,WAAW,YAAY,GAAG;AACjC,WAAO,mBAAmB,MAAM,SAAS,SAAS;AAAA,EACpD;AACA,MAAI,SAAS,aAAc,QAAO,sBAAsB,WAAW,CAAC,CAAC;AACrE,MAAI,SAAS,SAAU,QAAO,sBAAsB,WAAW,CAAC,CAAC;AACjE,SAAO,oBAAoB,MAAM,SAAS,UAAU,WAAW,OAAO;AACxE;",
+  "names": []
+}

package/dist/adapters/agents/selection-checks.d.ts

@@ -0,0 +1,63 @@
+/**
+ * Backend selection helpers: registry, readiness checks, client construction, approval posture.
+ */
+import type { BackendName } from '../../domain/core-client.js';
+import type { PermissionOptions } from '../../domain/permission.js';
+import type { BackendInfo } from '../../domain/protocol.js';
+import type { ApprovalCallbackPosture } from './approval-posture.js';
+export { checkBackend } from './selection-backend-checks.js';
+export { constructBackendClient } from './selection-construct-client.js';
+export { clearBackendRegistryCache, createBackendRegistry, getBackendType, } from './selection-registry.js';
+/**
+ * Resolve the `approvalCallback` posture for a backend.
+ *
+ * Resolution order (first non-undefined wins):
+ *
+ *   1. Live `BackendInfo.capabilities.approvalCallback` when a caller has
+ *      one in hand (most accurate — matches the real backend instance).
+ *   2. The name-based lookup in `approval-posture.ts`, which in turn uses
+ *      the SAME constants each built-in backend imports for its own
+ *      capability declaration — zero duplication, zero drift.
+ *   3. `'flag-only'` — the safe default: we tell callers their host
+ *      callback will NOT fire unless a backend explicitly states otherwise.
+ */
+export declare function getApprovalCallbackPosture(name: BackendName, info?: BackendInfo): ApprovalCallbackPosture;
+/**
+ * One-shot warning computed when the host registered an
+ * `onToolApproval` callback against a backend that will not invoke it.
+ *
+ * Keyed by `owner` (typically the owning Bridge) so that multi-bridge tests
+ * and long-lived processes each get their own warning. Returns the warning
+ * message on first emission and `null` on subsequent calls for the same
+ * owner. Callers are responsible for routing the message onto the event bus.
+ */
+export declare function maybeWarnApprovalCallbackGap(owner: object, args: {
+    firstPriority: BackendName;
+    firstPriorityInfo?: BackendInfo;
+    approvalMode: string;
+    hasCallback: boolean;
+}): string | null;
+/**
+ * One-shot warning computed when the host configured a `permission` preset
+ * that cannot reach a backend's tool calls.
+ *
+ * The runtime `permission` knob piggybacks on `BackendCapabilities.
+ * approvalCallback`: it gates only the tool calls the bridge dispatches via
+ * its action loop. For `flag-only` CLI backends (claude-code-cli, codex-cli,
+ * cursor-cli, gemini-cli) and `safety-gate` backends (custom CLI) the model invokes
+ * tools INSIDE the child process, so the action-loop gate never sees them
+ * and `permission` is silently inert. `transparent` (a2a) reflects the
+ * remote agent's policy. Without this warning the user gets `allow-all`
+ * semantics that look universal but are not.
+ *
+ * Returns the warning message on first emission per `owner` and `null` on
+ * subsequent calls. `permission.decision === 'ask'` is treated as an opt-in
+ * to the existing approval flow and does NOT warn — only the auto-decide
+ * presets (`allow`, `deny`) carry the false-coverage risk.
+ */
+export declare function maybeWarnPermissionPostureGap(owner: object, args: {
+    firstPriority: BackendName;
+    firstPriorityInfo?: BackendInfo;
+    permission: PermissionOptions;
+}): string | null;
+//# sourceMappingURL=selection-checks.d.ts.map

package/dist/adapters/agents/selection-checks.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"selection-checks.d.ts","sourceRoot":"","sources":["../../../src/adapters/agents/selection-checks.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,6BAA6B,CAAC;AAC/D,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AACpE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAC5D,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,uBAAuB,CAAC;AAGrE,OAAO,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAC;AAC7D,OAAO,EAAE,sBAAsB,EAAE,MAAM,iCAAiC,CAAC;AACzE,OAAO,EACL,yBAAyB,EACzB,qBAAqB,EACrB,cAAc,GACf,MAAM,yBAAyB,CAAC;AAEjC;;;;;;;;;;;;GAYG;AACH,wBAAgB,0BAA0B,CACxC,IAAI,EAAE,WAAW,EACjB,IAAI,CAAC,EAAE,WAAW,GACjB,uBAAuB,CAKzB;AAID;;;;;;;;GAQG;AACH,wBAAgB,4BAA4B,CAC1C,KAAK,EAAE,MAAM,EACb,IAAI,EAAE;IACJ,aAAa,EAAE,WAAW,CAAC;IAC3B,iBAAiB,CAAC,EAAE,WAAW,CAAC;IAChC,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,OAAO,CAAC;CACtB,GACA,MAAM,GAAG,IAAI,CAmBf;AAID;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,6BAA6B,CAC3C,KAAK,EAAE,MAAM,EACb,IAAI,EAAE;IACJ,aAAa,EAAE,WAAW,CAAC;IAC3B,iBAAiB,CAAC,EAAE,WAAW,CAAC;IAChC,UAAU,EAAE,iBAAiB,CAAC;CAC/B,GACA,MAAM,GAAG,IAAI,CAcf"}

package/dist/adapters/agents/selection-checks.js

@@ -0,0 +1,53 @@
+import { resolveBuiltInApprovalPosture } from "./approval-posture.js";
+import { checkBackend } from "./selection-backend-checks.js";
+import { constructBackendClient } from "./selection-construct-client.js";
+import {
+  clearBackendRegistryCache,
+  createBackendRegistry,
+  getBackendType
+} from "./selection-registry.js";
+function getApprovalCallbackPosture(name, info) {
+  if (info?.capabilities.approvalCallback) {
+    return info.capabilities.approvalCallback;
+  }
+  return resolveBuiltInApprovalPosture(name) ?? "flag-only";
+}
+const _approvalWarningEmitted = /* @__PURE__ */ new WeakSet();
+function maybeWarnApprovalCallbackGap(owner, args) {
+  if (!args.hasCallback) return null;
+  if (args.approvalMode === "off") return null;
+  const posture = getApprovalCallbackPosture(
+    args.firstPriority,
+    args.firstPriorityInfo
+  );
+  if (posture === "supported" || posture === "transparent") return null;
+  if (_approvalWarningEmitted.has(owner)) return null;
+  _approvalWarningEmitted.add(owner);
+  const hint = args.firstPriority === "claude-code-cli" ? " Install @anthropic-ai/claude-agent-sdk and prepend 'claude-code-sdk' to your priority for pre-execution parity." : "";
+  const detail = posture === "safety-gate" ? "approval happens via command deny-patterns before spawn; your host callback is NOT invoked" : "your callback is invoked observe-only AFTER the child process has already executed the tool, so returning false cannot block execution";
+  return `onToolApproval cannot gate tool execution: backend '${args.firstPriority}' has approvalCallback='${posture}' \u2014 ${detail}.${hint}`;
+}
+const _permissionPostureWarningEmitted = /* @__PURE__ */ new WeakSet();
+function maybeWarnPermissionPostureGap(owner, args) {
+  if (args.permission.decision === "ask") return null;
+  const posture = getApprovalCallbackPosture(
+    args.firstPriority,
+    args.firstPriorityInfo
+  );
+  if (posture === "supported" || posture === "transparent") return null;
+  if (_permissionPostureWarningEmitted.has(owner)) return null;
+  _permissionPostureWarningEmitted.add(owner);
+  const detail = posture === "safety-gate" ? "tool execution is gated by command deny-patterns before spawn; the permission preset cannot intercept individual tool calls" : `the model invokes tools inside the child process AFTER spawn \u2014 the bridge action loop never sees them, so 'permission: ${args.permission.decision}-...' has no effect on tool execution`;
+  return `permission preset cannot gate tool execution: backend '${args.firstPriority}' has approvalCallback='${posture}' \u2014 ${detail}.`;
+}
+export {
+  checkBackend,
+  clearBackendRegistryCache,
+  constructBackendClient,
+  createBackendRegistry,
+  getApprovalCallbackPosture,
+  getBackendType,
+  maybeWarnApprovalCallbackGap,
+  maybeWarnPermissionPostureGap
+};
+//# sourceMappingURL=selection-checks.js.map

package/dist/adapters/agents/selection-checks.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../src/adapters/agents/selection-checks.ts"],
+  "sourcesContent": ["/**\n * Backend selection helpers: registry, readiness checks, client construction, approval posture.\n */\n\nimport type { BackendName } from '../../domain/core-client.js';\nimport type { PermissionOptions } from '../../domain/permission.js';\nimport type { BackendInfo } from '../../domain/protocol.js';\nimport type { ApprovalCallbackPosture } from './approval-posture.js';\nimport { resolveBuiltInApprovalPosture } from './approval-posture.js';\n\nexport { checkBackend } from './selection-backend-checks.js';\nexport { constructBackendClient } from './selection-construct-client.js';\nexport {\n  clearBackendRegistryCache,\n  createBackendRegistry,\n  getBackendType,\n} from './selection-registry.js';\n\n/**\n * Resolve the `approvalCallback` posture for a backend.\n *\n * Resolution order (first non-undefined wins):\n *\n *   1. Live `BackendInfo.capabilities.approvalCallback` when a caller has\n *      one in hand (most accurate \u2014 matches the real backend instance).\n *   2. The name-based lookup in `approval-posture.ts`, which in turn uses\n *      the SAME constants each built-in backend imports for its own\n *      capability declaration \u2014 zero duplication, zero drift.\n *   3. `'flag-only'` \u2014 the safe default: we tell callers their host\n *      callback will NOT fire unless a backend explicitly states otherwise.\n */\nexport function getApprovalCallbackPosture(\n  name: BackendName,\n  info?: BackendInfo\n): ApprovalCallbackPosture {\n  if (info?.capabilities.approvalCallback) {\n    return info.capabilities.approvalCallback;\n  }\n  return resolveBuiltInApprovalPosture(name) ?? 'flag-only';\n}\n\nconst _approvalWarningEmitted = new WeakSet<object>();\n\n/**\n * One-shot warning computed when the host registered an\n * `onToolApproval` callback against a backend that will not invoke it.\n *\n * Keyed by `owner` (typically the owning Bridge) so that multi-bridge tests\n * and long-lived processes each get their own warning. Returns the warning\n * message on first emission and `null` on subsequent calls for the same\n * owner. Callers are responsible for routing the message onto the event bus.\n */\nexport function maybeWarnApprovalCallbackGap(\n  owner: object,\n  args: {\n    firstPriority: BackendName;\n    firstPriorityInfo?: BackendInfo;\n    approvalMode: string;\n    hasCallback: boolean;\n  }\n): string | null {\n  if (!args.hasCallback) return null;\n  if (args.approvalMode === 'off') return null;\n  const posture = getApprovalCallbackPosture(\n    args.firstPriority,\n    args.firstPriorityInfo\n  );\n  if (posture === 'supported' || posture === 'transparent') return null;\n  if (_approvalWarningEmitted.has(owner)) return null;\n  _approvalWarningEmitted.add(owner);\n  const hint =\n    args.firstPriority === 'claude-code-cli'\n      ? \" Install @anthropic-ai/claude-agent-sdk and prepend 'claude-code-sdk' to your priority for pre-execution parity.\"\n      : '';\n  const detail =\n    posture === 'safety-gate'\n      ? 'approval happens via command deny-patterns before spawn; your host callback is NOT invoked'\n      : 'your callback is invoked observe-only AFTER the child process has already executed the tool, so returning false cannot block execution';\n  return `onToolApproval cannot gate tool execution: backend '${args.firstPriority}' has approvalCallback='${posture}' \u2014 ${detail}.${hint}`;\n}\n\nconst _permissionPostureWarningEmitted = new WeakSet<object>();\n\n/**\n * One-shot warning computed when the host configured a `permission` preset\n * that cannot reach a backend's tool calls.\n *\n * The runtime `permission` knob piggybacks on `BackendCapabilities.\n * approvalCallback`: it gates only the tool calls the bridge dispatches via\n * its action loop. For `flag-only` CLI backends (claude-code-cli, codex-cli,\n * cursor-cli, gemini-cli) and `safety-gate` backends (custom CLI) the model invokes\n * tools INSIDE the child process, so the action-loop gate never sees them\n * and `permission` is silently inert. `transparent` (a2a) reflects the\n * remote agent's policy. Without this warning the user gets `allow-all`\n * semantics that look universal but are not.\n *\n * Returns the warning message on first emission per `owner` and `null` on\n * subsequent calls. `permission.decision === 'ask'` is treated as an opt-in\n * to the existing approval flow and does NOT warn \u2014 only the auto-decide\n * presets (`allow`, `deny`) carry the false-coverage risk.\n */\nexport function maybeWarnPermissionPostureGap(\n  owner: object,\n  args: {\n    firstPriority: BackendName;\n    firstPriorityInfo?: BackendInfo;\n    permission: PermissionOptions;\n  }\n): string | null {\n  if (args.permission.decision === 'ask') return null;\n  const posture = getApprovalCallbackPosture(\n    args.firstPriority,\n    args.firstPriorityInfo\n  );\n  if (posture === 'supported' || posture === 'transparent') return null;\n  if (_permissionPostureWarningEmitted.has(owner)) return null;\n  _permissionPostureWarningEmitted.add(owner);\n  const detail =\n    posture === 'safety-gate'\n      ? 'tool execution is gated by command deny-patterns before spawn; the permission preset cannot intercept individual tool calls'\n      : `the model invokes tools inside the child process AFTER spawn \u2014 the bridge action loop never sees them, so 'permission: ${args.permission.decision}-...' has no effect on tool execution`;\n  return `permission preset cannot gate tool execution: backend '${args.firstPriority}' has approvalCallback='${posture}' \u2014 ${detail}.`;\n}\n"],
+  "mappings": "AAQA,SAAS,qCAAqC;AAE9C,SAAS,oBAAoB;AAC7B,SAAS,8BAA8B;AACvC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAeA,SAAS,2BACd,MACA,MACyB;AACzB,MAAI,MAAM,aAAa,kBAAkB;AACvC,WAAO,KAAK,aAAa;AAAA,EAC3B;AACA,SAAO,8BAA8B,IAAI,KAAK;AAChD;AAEA,MAAM,0BAA0B,oBAAI,QAAgB;AAW7C,SAAS,6BACd,OACA,MAMe;AACf,MAAI,CAAC,KAAK,YAAa,QAAO;AAC9B,MAAI,KAAK,iBAAiB,MAAO,QAAO;AACxC,QAAM,UAAU;AAAA,IACd,KAAK;AAAA,IACL,KAAK;AAAA,EACP;AACA,MAAI,YAAY,eAAe,YAAY,cAAe,QAAO;AACjE,MAAI,wBAAwB,IAAI,KAAK,EAAG,QAAO;AAC/C,0BAAwB,IAAI,KAAK;AACjC,QAAM,OACJ,KAAK,kBAAkB,oBACnB,qHACA;AACN,QAAM,SACJ,YAAY,gBACR,+FACA;AACN,SAAO,uDAAuD,KAAK,aAAa,2BAA2B,OAAO,YAAO,MAAM,IAAI,IAAI;AACzI;AAEA,MAAM,mCAAmC,oBAAI,QAAgB;AAoBtD,SAAS,8BACd,OACA,MAKe;AACf,MAAI,KAAK,WAAW,aAAa,MAAO,QAAO;AAC/C,QAAM,UAAU;AAAA,IACd,KAAK;AAAA,IACL,KAAK;AAAA,EACP;AACA,MAAI,YAAY,eAAe,YAAY,cAAe,QAAO;AACjE,MAAI,iCAAiC,IAAI,KAAK,EAAG,QAAO;AACxD,mCAAiC,IAAI,KAAK;AAC1C,QAAM,SACJ,YAAY,gBACR,gIACA,+HAA0H,KAAK,WAAW,QAAQ;AACxJ,SAAO,0DAA0D,KAAK,aAAa,2BAA2B,OAAO,YAAO,MAAM;AACpI;",
+  "names": []
+}

package/dist/adapters/agents/selection-construct-client.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Construct the concrete {@link Client} for a resolved backend name.
+ */
+import type { AuthStore } from '../../auth/types.js';
+import type { BackendName, Client } from '../../domain/core-client.js';
+import type { BackendSelectionOptions } from './selection.js';
+export declare function constructBackendClient(name: BackendName, apiKeys: Partial<Record<BackendName, string>>, options: BackendSelectionOptions, authStore?: AuthStore): Client;
+//# sourceMappingURL=selection-construct-client.d.ts.map

package/dist/adapters/agents/selection-construct-client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"selection-construct-client.d.ts","sourceRoot":"","sources":["../../../src/adapters/agents/selection-construct-client.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AACrD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,6BAA6B,CAAC;AAMvE,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,gBAAgB,CAAC;AAiC9D,wBAAgB,sBAAsB,CACpC,IAAI,EAAE,WAAW,EACjB,OAAO,EAAE,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,EAC7C,OAAO,EAAE,uBAAuB,EAChC,SAAS,CAAC,EAAE,SAAS,GACpB,MAAM,CA4ER"}

package/dist/adapters/agents/selection-construct-client.js

@@ -0,0 +1,99 @@
+import { CLI_OAUTH_ENV_MAP, getApiKey } from "../../utils/api-keys.js";
+import { AgentClient } from "./agent-client.js";
+import { CustomApiClient } from "./custom-api-client.js";
+import { CustomCliClient } from "./custom-cli-client.js";
+import { OllamaClient } from "./ollama/index.js";
+import { VercelAiClient } from "./vercel-client.js";
+function resolveCliOAuthEnv(name, apiKeys, authStore) {
+  if (!authStore) return void 0;
+  const mapping = CLI_OAUTH_ENV_MAP[name];
+  if (!mapping) return void 0;
+  if (apiKeys[name] || process.env[mapping.envVar]) return void 0;
+  const token = authStore.getTokenSync(mapping.provider);
+  if (!token?.accessToken) return void 0;
+  return { [mapping.envVar]: token.accessToken };
+}
+function mergeProcessEnv(userEnv, oauthEnv) {
+  if (!userEnv && !oauthEnv) return void 0;
+  return { ...oauthEnv ?? {}, ...userEnv ?? {} };
+}
+function constructBackendClient(name, apiKeys, options, authStore) {
+  const retries = options.retries ?? 0;
+  if (name === "ollama") {
+    return new OllamaClient({
+      apiKey: getApiKey(name, apiKeys, authStore),
+      model: options.model,
+      host: options.hosts?.[name],
+      headers: options.headersMap?.[name],
+      systemPrompt: options.systemPrompt,
+      timeoutMs: options.timeoutMs,
+      retries,
+      maxContext: options.maxContext
+    });
+  }
+  if (name.startsWith("vercel-ai:")) {
+    return new VercelAiClient({
+      provider: name.replace("vercel-ai:", ""),
+      apiKey: getApiKey(name, apiKeys, authStore) ?? "",
+      model: options.model,
+      systemPrompt: options.systemPrompt,
+      timeoutMs: options.timeoutMs,
+      retries
+    });
+  }
+  if (name === "custom-api") {
+    if (!options.customApi?.url) {
+      throw new Error(
+        "custom-api backend selected but `customApi.url` was not provided"
+      );
+    }
+    return new CustomApiClient({
+      ...options.customApi,
+      model: options.model ?? options.customApi.model,
+      systemPrompt: options.systemPrompt ?? options.customApi.systemPrompt,
+      timeoutMs: options.timeoutMs ?? options.customApi.timeoutMs
+    });
+  }
+  if (name === "custom") {
+    if (!options.customCli?.command) {
+      throw new Error(
+        "custom backend selected but `customCli.command` was not provided"
+      );
+    }
+    return new CustomCliClient({
+      ...options.customCli,
+      model: options.model ?? options.customCli.model,
+      systemPrompt: options.systemPrompt ?? options.customCli.systemPrompt,
+      cwd: options.cwd ?? options.customCli.cwd,
+      timeoutMs: options.timeoutMs ?? options.customCli.timeoutMs,
+      skipInstallCheck: options.skipInstallCheck ?? true
+    });
+  }
+  return new AgentClient({
+    backend: name,
+    approvalMode: options.approvalMode,
+    apiKey: getApiKey(name, apiKeys, authStore),
+    headers: options.headersMap?.[name],
+    host: options.hosts?.[name],
+    config: options.config,
+    profile: options.profile,
+    model: options.model,
+    systemPrompt: options.systemPrompt,
+    cwd: options.cwd,
+    timeoutMs: options.timeoutMs,
+    mcpConfigPath: options.mcpConfigPath,
+    retries,
+    skipInstallCheck: options.skipInstallCheck ?? true,
+    runner: options.runner,
+    env: mergeProcessEnv(
+      options.env,
+      resolveCliOAuthEnv(name, apiKeys, authStore)
+    ),
+    maxContext: options.maxContext,
+    onAcpElicitation: options.onAcpElicitation
+  });
+}
+export {
+  constructBackendClient
+};
+//# sourceMappingURL=selection-construct-client.js.map

package/dist/adapters/agents/selection-construct-client.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../src/adapters/agents/selection-construct-client.ts"],
+  "sourcesContent": ["/**\n * Construct the concrete {@link Client} for a resolved backend name.\n */\n\nimport type { AuthStore } from '../../auth/types.js';\nimport type { BackendName, Client } from '../../domain/core-client.js';\nimport { CLI_OAUTH_ENV_MAP, getApiKey } from '../../utils/api-keys.js';\nimport { AgentClient } from './agent-client.js';\nimport { CustomApiClient } from './custom-api-client.js';\nimport { CustomCliClient } from './custom-cli-client.js';\nimport { OllamaClient } from './ollama/index.js';\nimport type { BackendSelectionOptions } from './selection.js';\nimport type { VercelProvider } from './vercel-client.js';\nimport { VercelAiClient } from './vercel-client.js';\n\nfunction resolveCliOAuthEnv(\n  name: BackendName,\n  apiKeys: Partial<Record<BackendName, string>>,\n  authStore?: AuthStore\n): Record<string, string> | undefined {\n  if (!authStore) return undefined;\n  const mapping = CLI_OAUTH_ENV_MAP[name];\n  if (!mapping) return undefined;\n  if (apiKeys[name] || process.env[mapping.envVar]) return undefined;\n  const token = authStore.getTokenSync(mapping.provider);\n  if (!token?.accessToken) return undefined;\n  return { [mapping.envVar]: token.accessToken };\n}\n\n/**\n * Merge caller-supplied env with OAuth-derived env. OAuth values set the\n * baseline (filling in missing API-key env vars); explicit `options.env`\n * wins on key collision so users always get what they wrote. Returns\n * `undefined` when neither side has anything to contribute, so the child\n * process inherits the parent env unchanged.\n */\nfunction mergeProcessEnv(\n  userEnv: Record<string, string> | undefined,\n  oauthEnv: Record<string, string> | undefined\n): Record<string, string> | undefined {\n  if (!userEnv && !oauthEnv) return undefined;\n  return { ...(oauthEnv ?? {}), ...(userEnv ?? {}) };\n}\n\nexport function constructBackendClient(\n  name: BackendName,\n  apiKeys: Partial<Record<BackendName, string>>,\n  options: BackendSelectionOptions,\n  authStore?: AuthStore\n): Client {\n  const retries = options.retries ?? 0;\n\n  if (name === 'ollama') {\n    return new OllamaClient({\n      apiKey: getApiKey(name, apiKeys, authStore),\n      model: options.model,\n      host: options.hosts?.[name],\n      headers: options.headersMap?.[name],\n      systemPrompt: options.systemPrompt,\n      timeoutMs: options.timeoutMs,\n      retries,\n      maxContext: options.maxContext,\n    });\n  }\n  if (name.startsWith('vercel-ai:')) {\n    return new VercelAiClient({\n      provider: name.replace('vercel-ai:', '') as VercelProvider,\n      apiKey: getApiKey(name, apiKeys, authStore) ?? '',\n      model: options.model,\n      systemPrompt: options.systemPrompt,\n      timeoutMs: options.timeoutMs,\n      retries,\n    });\n  }\n  if (name === 'custom-api') {\n    if (!options.customApi?.url) {\n      throw new Error(\n        'custom-api backend selected but `customApi.url` was not provided'\n      );\n    }\n    return new CustomApiClient({\n      ...options.customApi,\n      model: options.model ?? options.customApi.model,\n      systemPrompt: options.systemPrompt ?? options.customApi.systemPrompt,\n      timeoutMs: options.timeoutMs ?? options.customApi.timeoutMs,\n    });\n  }\n  if (name === 'custom') {\n    if (!options.customCli?.command) {\n      throw new Error(\n        'custom backend selected but `customCli.command` was not provided'\n      );\n    }\n    return new CustomCliClient({\n      ...options.customCli,\n      model: options.model ?? options.customCli.model,\n      systemPrompt: options.systemPrompt ?? options.customCli.systemPrompt,\n      cwd: options.cwd ?? options.customCli.cwd,\n      timeoutMs: options.timeoutMs ?? options.customCli.timeoutMs,\n      skipInstallCheck: options.skipInstallCheck ?? true,\n    });\n  }\n  return new AgentClient({\n    backend: name,\n    approvalMode: options.approvalMode,\n    apiKey: getApiKey(name, apiKeys, authStore),\n    headers: options.headersMap?.[name],\n    host: options.hosts?.[name],\n    config: options.config,\n    profile: options.profile,\n    model: options.model,\n    systemPrompt: options.systemPrompt,\n    cwd: options.cwd,\n    timeoutMs: options.timeoutMs,\n    mcpConfigPath: options.mcpConfigPath,\n    retries,\n    skipInstallCheck: options.skipInstallCheck ?? true,\n    runner: options.runner,\n    env: mergeProcessEnv(\n      options.env,\n      resolveCliOAuthEnv(name, apiKeys, authStore)\n    ),\n    maxContext: options.maxContext,\n    onAcpElicitation: options.onAcpElicitation,\n  });\n}\n"],
+  "mappings": "AAMA,SAAS,mBAAmB,iBAAiB;AAC7C,SAAS,mBAAmB;AAC5B,SAAS,uBAAuB;AAChC,SAAS,uBAAuB;AAChC,SAAS,oBAAoB;AAG7B,SAAS,sBAAsB;AAE/B,SAAS,mBACP,MACA,SACA,WACoC;AACpC,MAAI,CAAC,UAAW,QAAO;AACvB,QAAM,UAAU,kBAAkB,IAAI;AACtC,MAAI,CAAC,QAAS,QAAO;AACrB,MAAI,QAAQ,IAAI,KAAK,QAAQ,IAAI,QAAQ,MAAM,EAAG,QAAO;AACzD,QAAM,QAAQ,UAAU,aAAa,QAAQ,QAAQ;AACrD,MAAI,CAAC,OAAO,YAAa,QAAO;AAChC,SAAO,EAAE,CAAC,QAAQ,MAAM,GAAG,MAAM,YAAY;AAC/C;AASA,SAAS,gBACP,SACA,UACoC;AACpC,MAAI,CAAC,WAAW,CAAC,SAAU,QAAO;AAClC,SAAO,EAAE,GAAI,YAAY,CAAC,GAAI,GAAI,WAAW,CAAC,EAAG;AACnD;AAEO,SAAS,uBACd,MACA,SACA,SACA,WACQ;AACR,QAAM,UAAU,QAAQ,WAAW;AAEnC,MAAI,SAAS,UAAU;AACrB,WAAO,IAAI,aAAa;AAAA,MACtB,QAAQ,UAAU,MAAM,SAAS,SAAS;AAAA,MAC1C,OAAO,QAAQ;AAAA,MACf,MAAM,QAAQ,QAAQ,IAAI;AAAA,MAC1B,SAAS,QAAQ,aAAa,IAAI;AAAA,MAClC,cAAc,QAAQ;AAAA,MACtB,WAAW,QAAQ;AAAA,MACnB;AAAA,MACA,YAAY,QAAQ;AAAA,IACtB,CAAC;AAAA,EACH;AACA,MAAI,KAAK,WAAW,YAAY,GAAG;AACjC,WAAO,IAAI,eAAe;AAAA,MACxB,UAAU,KAAK,QAAQ,cAAc,EAAE;AAAA,MACvC,QAAQ,UAAU,MAAM,SAAS,SAAS,KAAK;AAAA,MAC/C,OAAO,QAAQ;AAAA,MACf,cAAc,QAAQ;AAAA,MACtB,WAAW,QAAQ;AAAA,MACnB;AAAA,IACF,CAAC;AAAA,EACH;AACA,MAAI,SAAS,cAAc;AACzB,QAAI,CAAC,QAAQ,WAAW,KAAK;AAC3B,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,WAAO,IAAI,gBAAgB;AAAA,MACzB,GAAG,QAAQ;AAAA,MACX,OAAO,QAAQ,SAAS,QAAQ,UAAU;AAAA,MAC1C,cAAc,QAAQ,gBAAgB,QAAQ,UAAU;AAAA,MACxD,WAAW,QAAQ,aAAa,QAAQ,UAAU;AAAA,IACpD,CAAC;AAAA,EACH;AACA,MAAI,SAAS,UAAU;AACrB,QAAI,CAAC,QAAQ,WAAW,SAAS;AAC/B,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,WAAO,IAAI,gBAAgB;AAAA,MACzB,GAAG,QAAQ;AAAA,MACX,OAAO,QAAQ,SAAS,QAAQ,UAAU;AAAA,MAC1C,cAAc,QAAQ,gBAAgB,QAAQ,UAAU;AAAA,MACxD,KAAK,QAAQ,OAAO,QAAQ,UAAU;AAAA,MACtC,WAAW,QAAQ,aAAa,QAAQ,UAAU;AAAA,MAClD,kBAAkB,QAAQ,oBAAoB;AAAA,IAChD,CAAC;AAAA,EACH;AACA,SAAO,IAAI,YAAY;AAAA,IACrB,SAAS;AAAA,IACT,cAAc,QAAQ;AAAA,IACtB,QAAQ,UAAU,MAAM,SAAS,SAAS;AAAA,IAC1C,SAAS,QAAQ,aAAa,IAAI;AAAA,IAClC,MAAM,QAAQ,QAAQ,IAAI;AAAA,IAC1B,QAAQ,QAAQ;AAAA,IAChB,SAAS,QAAQ;AAAA,IACjB,OAAO,QAAQ;AAAA,IACf,cAAc,QAAQ;AAAA,IACtB,KAAK,QAAQ;AAAA,IACb,WAAW,QAAQ;AAAA,IACnB,eAAe,QAAQ;AAAA,IACvB;AAAA,IACA,kBAAkB,QAAQ,oBAAoB;AAAA,IAC9C,QAAQ,QAAQ;AAAA,IAChB,KAAK;AAAA,MACH,QAAQ;AAAA,MACR,mBAAmB,MAAM,SAAS,SAAS;AAAA,IAC7C;AAAA,IACA,YAAY,QAAQ;AAAA,IACpB,kBAAkB,QAAQ;AAAA,EAC5B,CAAC;AACH;",
+  "names": []
+}

package/dist/adapters/agents/selection-registry.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Built-in backend registry cache and {@link createBackendRegistry}.
+ */
+import type { AuthStore } from '../../auth/types.js';
+import type { AcpElicitationRequest, AcpElicitationResponse } from '../../domain/acp-elicitation.js';
+import type { BackendName } from '../../domain/core-client.js';
+import type { BackendType } from '../../domain/protocol.js';
+import { type BackendRegistry } from './backends/index.js';
+export declare function getBackendType(name: BackendName): BackendType;
+export declare function clearBackendRegistryCache(): void;
+export declare function createBackendRegistry(apiKeys: Partial<Record<BackendName, string>>, authStore?: AuthStore, hosts?: Partial<Record<BackendName, string>>, headersMap?: Partial<Record<BackendName, Record<string, string>>>, onAcpElicitation?: (req: AcpElicitationRequest) => Promise<AcpElicitationResponse>): BackendRegistry;
+//# sourceMappingURL=selection-registry.d.ts.map

package/dist/adapters/agents/selection-registry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"selection-registry.d.ts","sourceRoot":"","sources":["../../../src/adapters/agents/selection-registry.ts"],"names":[],"mappings":"AAAA;;GAEG;AAIH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AACrD,OAAO,KAAK,EAAE,qBAAqB,EAAE,sBAAsB,EAAE,MAAM,iCAAiC,CAAC;AACrG,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,6BAA6B,CAAC;AAC/D,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAO5D,OAAO,EACL,KAAK,eAAe,EAGrB,MAAM,qBAAqB,CAAC;AAa7B,wBAAgB,cAAc,CAAC,IAAI,EAAE,WAAW,GAAG,WAAW,CAY7D;AAoCD,wBAAgB,yBAAyB,IAAI,IAAI,CAEhD;AAED,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,EAC7C,SAAS,CAAC,EAAE,SAAS,EACrB,KAAK,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,EAC5C,UAAU,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,EACjE,gBAAgB,CAAC,EAAE,CAAC,GAAG,EAAE,qBAAqB,KAAK,OAAO,CAAC,sBAAsB,CAAC,GACjF,eAAe,CAsCjB"}

package/dist/adapters/agents/selection-registry.js

@@ -0,0 +1,83 @@
+import { createHash } from "node:crypto";
+import {
+  API_KEY_ENV,
+  getApiKey,
+  HOST_CONFIG_KEY,
+  OAUTH_PROVIDER_MAP
+} from "../../utils/api-keys.js";
+import {
+  createBuiltInBackends
+} from "./backends/index.js";
+function isConfigurableBuiltInBackend(backend) {
+  return backend === "anthropic-api" || backend === "gemini-api" || backend === "openai-api" || backend === "ollama";
+}
+function getBackendType(name) {
+  if (name.startsWith("vercel-ai:")) return "sdk";
+  if (name === "ollama") return "local";
+  if (name === "anthropic-api" || name === "gemini-api" || name === "openai-api" || name === "custom-api") {
+    return "api";
+  }
+  return "cli";
+}
+let cachedRegistry = null;
+function hashSensitiveValue(value) {
+  if (!value) return null;
+  return createHash("sha256").update(value).digest("hex");
+}
+function buildRegistryCacheKey(apiKeys, authStore, hosts, headersMap) {
+  const envKeys = Object.entries(API_KEY_ENV).map(([backend, envKey]) => [
+    backend,
+    hashSensitiveValue(process.env[envKey])
+  ]);
+  const oauthProviders = [...new Set(Object.values(OAUTH_PROVIDER_MAP))];
+  const oauthTokens = authStore ? oauthProviders.map((provider) => [
+    provider,
+    hashSensitiveValue(authStore.getTokenSync(provider)?.accessToken)
+  ]) : [];
+  return JSON.stringify({
+    apiKeys,
+    hosts: hosts ?? {},
+    headersMap: headersMap ?? {},
+    envKeys,
+    oauthTokens
+  });
+}
+function clearBackendRegistryCache() {
+  cachedRegistry = null;
+}
+function createBackendRegistry(apiKeys, authStore, hosts, headersMap, onAcpElicitation) {
+  const cacheKey = buildRegistryCacheKey(apiKeys, authStore, hosts, headersMap);
+  if (!onAcpElicitation && cachedRegistry && cachedRegistry.keys === cacheKey) {
+    return cachedRegistry.registry;
+  }
+  const backendConfig = {};
+  for (const [backend, envKey] of Object.entries(API_KEY_ENV)) {
+    if (backend.startsWith("vercel-ai:") || backend === "ollama") continue;
+    const apiKey = getApiKey(backend, apiKeys, authStore);
+    const hostKey = HOST_CONFIG_KEY[backend];
+    const host = hosts?.[backend];
+    const headers = headersMap?.[backend];
+    if (!apiKey && !host && !headers) continue;
+    if (!isConfigurableBuiltInBackend(backend)) continue;
+    backendConfig[backend] = {
+      ...apiKey ? { [envKey]: apiKey } : {},
+      ...host && hostKey ? { [hostKey]: host } : {},
+      ...headers ? { EXTRA_HEADERS: headers } : {}
+    };
+  }
+  if (onAcpElicitation) {
+    backendConfig["acp-cli"] = {
+      ...backendConfig["acp-cli"],
+      onElicitation: onAcpElicitation
+    };
+  }
+  const registry = createBuiltInBackends(backendConfig);
+  if (!onAcpElicitation) cachedRegistry = { keys: cacheKey, registry };
+  return registry;
+}
+export {
+  clearBackendRegistryCache,
+  createBackendRegistry,
+  getBackendType
+};
+//# sourceMappingURL=selection-registry.js.map

package/dist/adapters/agents/selection-registry.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../src/adapters/agents/selection-registry.ts"],
+  "sourcesContent": ["/**\n * Built-in backend registry cache and {@link createBackendRegistry}.\n */\n\nimport { createHash } from 'node:crypto';\n\nimport type { AuthStore } from '../../auth/types.js';\nimport type { AcpElicitationRequest, AcpElicitationResponse } from '../../domain/acp-elicitation.js';\nimport type { BackendName } from '../../domain/core-client.js';\nimport type { BackendType } from '../../domain/protocol.js';\nimport {\n  API_KEY_ENV,\n  getApiKey,\n  HOST_CONFIG_KEY,\n  OAUTH_PROVIDER_MAP,\n} from '../../utils/api-keys.js';\nimport {\n  type BackendRegistry,\n  type BuiltInBackendConfigMap,\n  createBuiltInBackends,\n} from './backends/index.js';\n\nfunction isConfigurableBuiltInBackend(\n  backend: BackendName\n): backend is keyof BuiltInBackendConfigMap {\n  return (\n    backend === 'anthropic-api' ||\n    backend === 'gemini-api' ||\n    backend === 'openai-api' ||\n    backend === 'ollama'\n  );\n}\n\nexport function getBackendType(name: BackendName): BackendType {\n  if (name.startsWith('vercel-ai:')) return 'sdk';\n  if (name === 'ollama') return 'local';\n  if (\n    name === 'anthropic-api' ||\n    name === 'gemini-api' ||\n    name === 'openai-api' ||\n    name === 'custom-api'\n  ) {\n    return 'api';\n  }\n  return 'cli';\n}\n\nlet cachedRegistry: { keys: string; registry: BackendRegistry } | null = null;\n\nfunction hashSensitiveValue(value: string | null | undefined): string | null {\n  if (!value) return null;\n  return createHash('sha256').update(value).digest('hex');\n}\n\nfunction buildRegistryCacheKey(\n  apiKeys: Partial<Record<BackendName, string>>,\n  authStore?: AuthStore,\n  hosts?: Partial<Record<BackendName, string>>,\n  headersMap?: Partial<Record<BackendName, Record<string, string>>>\n): string {\n  const envKeys = Object.entries(API_KEY_ENV).map(([backend, envKey]) => [\n    backend,\n    hashSensitiveValue(process.env[envKey]),\n  ]);\n  const oauthProviders = [...new Set(Object.values(OAUTH_PROVIDER_MAP))];\n  const oauthTokens = authStore\n    ? oauthProviders.map((provider) => [\n        provider,\n        hashSensitiveValue(authStore.getTokenSync(provider)?.accessToken),\n      ])\n    : [];\n\n  return JSON.stringify({\n    apiKeys,\n    hosts: hosts ?? {},\n    headersMap: headersMap ?? {},\n    envKeys,\n    oauthTokens,\n  });\n}\n\nexport function clearBackendRegistryCache(): void {\n  cachedRegistry = null;\n}\n\nexport function createBackendRegistry(\n  apiKeys: Partial<Record<BackendName, string>>,\n  authStore?: AuthStore,\n  hosts?: Partial<Record<BackendName, string>>,\n  headersMap?: Partial<Record<BackendName, Record<string, string>>>,\n  onAcpElicitation?: (req: AcpElicitationRequest) => Promise<AcpElicitationResponse>\n): BackendRegistry {\n  const cacheKey = buildRegistryCacheKey(apiKeys, authStore, hosts, headersMap);\n\n  // Bypass the cache when a stateful callback is provided \u2014 function references\n  // cannot be serialized into a stable cache key.\n  if (!onAcpElicitation && cachedRegistry && cachedRegistry.keys === cacheKey) {\n    return cachedRegistry.registry;\n  }\n\n  const backendConfig: BuiltInBackendConfigMap = {};\n\n  for (const [backend, envKey] of Object.entries(API_KEY_ENV) as Array<\n    [BackendName, string]\n  >) {\n    if (backend.startsWith('vercel-ai:') || backend === 'ollama') continue;\n    const apiKey = getApiKey(backend, apiKeys, authStore);\n    const hostKey = HOST_CONFIG_KEY[backend];\n    const host = hosts?.[backend];\n    const headers = headersMap?.[backend];\n    if (!apiKey && !host && !headers) continue;\n    if (!isConfigurableBuiltInBackend(backend)) continue;\n    backendConfig[backend] = {\n      ...(apiKey ? { [envKey]: apiKey } : {}),\n      ...(host && hostKey ? { [hostKey]: host } : {}),\n      ...(headers ? { EXTRA_HEADERS: headers } : {}),\n    };\n  }\n\n  if (onAcpElicitation) {\n    backendConfig['acp-cli'] = {\n      ...backendConfig['acp-cli'],\n      onElicitation: onAcpElicitation,\n    };\n  }\n\n  const registry = createBuiltInBackends(backendConfig);\n  if (!onAcpElicitation) cachedRegistry = { keys: cacheKey, registry };\n  return registry;\n}\n"],
+  "mappings": "AAIA,SAAS,kBAAkB;AAM3B;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP;AAAA,EAGE;AAAA,OACK;AAEP,SAAS,6BACP,SAC0C;AAC1C,SACE,YAAY,mBACZ,YAAY,gBACZ,YAAY,gBACZ,YAAY;AAEhB;AAEO,SAAS,eAAe,MAAgC;AAC7D,MAAI,KAAK,WAAW,YAAY,EAAG,QAAO;AAC1C,MAAI,SAAS,SAAU,QAAO;AAC9B,MACE,SAAS,mBACT,SAAS,gBACT,SAAS,gBACT,SAAS,cACT;AACA,WAAO;AAAA,EACT;AACA,SAAO;AACT;AAEA,IAAI,iBAAqE;AAEzE,SAAS,mBAAmB,OAAiD;AAC3E,MAAI,CAAC,MAAO,QAAO;AACnB,SAAO,WAAW,QAAQ,EAAE,OAAO,KAAK,EAAE,OAAO,KAAK;AACxD;AAEA,SAAS,sBACP,SACA,WACA,OACA,YACQ;AACR,QAAM,UAAU,OAAO,QAAQ,WAAW,EAAE,IAAI,CAAC,CAAC,SAAS,MAAM,MAAM;AAAA,IACrE;AAAA,IACA,mBAAmB,QAAQ,IAAI,MAAM,CAAC;AAAA,EACxC,CAAC;AACD,QAAM,iBAAiB,CAAC,GAAG,IAAI,IAAI,OAAO,OAAO,kBAAkB,CAAC,CAAC;AACrE,QAAM,cAAc,YAChB,eAAe,IAAI,CAAC,aAAa;AAAA,IAC/B;AAAA,IACA,mBAAmB,UAAU,aAAa,QAAQ,GAAG,WAAW;AAAA,EAClE,CAAC,IACD,CAAC;AAEL,SAAO,KAAK,UAAU;AAAA,IACpB;AAAA,IACA,OAAO,SAAS,CAAC;AAAA,IACjB,YAAY,cAAc,CAAC;AAAA,IAC3B;AAAA,IACA;AAAA,EACF,CAAC;AACH;AAEO,SAAS,4BAAkC;AAChD,mBAAiB;AACnB;AAEO,SAAS,sBACd,SACA,WACA,OACA,YACA,kBACiB;AACjB,QAAM,WAAW,sBAAsB,SAAS,WAAW,OAAO,UAAU;AAI5E,MAAI,CAAC,oBAAoB,kBAAkB,eAAe,SAAS,UAAU;AAC3E,WAAO,eAAe;AAAA,EACxB;AAEA,QAAM,gBAAyC,CAAC;AAEhD,aAAW,CAAC,SAAS,MAAM,KAAK,OAAO,QAAQ,WAAW,GAEvD;AACD,QAAI,QAAQ,WAAW,YAAY,KAAK,YAAY,SAAU;AAC9D,UAAM,SAAS,UAAU,SAAS,SAAS,SAAS;AACpD,UAAM,UAAU,gBAAgB,OAAO;AACvC,UAAM,OAAO,QAAQ,OAAO;AAC5B,UAAM,UAAU,aAAa,OAAO;AACpC,QAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,QAAS;AAClC,QAAI,CAAC,6BAA6B,OAAO,EAAG;AAC5C,kBAAc,OAAO,IAAI;AAAA,MACvB,GAAI,SAAS,EAAE,CAAC,MAAM,GAAG,OAAO,IAAI,CAAC;AAAA,MACrC,GAAI,QAAQ,UAAU,EAAE,CAAC,OAAO,GAAG,KAAK,IAAI,CAAC;AAAA,MAC7C,GAAI,UAAU,EAAE,eAAe,QAAQ,IAAI,CAAC;AAAA,IAC9C;AAAA,EACF;AAEA,MAAI,kBAAkB;AACpB,kBAAc,SAAS,IAAI;AAAA,MACzB,GAAG,cAAc,SAAS;AAAA,MAC1B,eAAe;AAAA,IACjB;AAAA,EACF;AAEA,QAAM,WAAW,sBAAsB,aAAa;AACpD,MAAI,CAAC,iBAAkB,kBAAiB,EAAE,MAAM,UAAU,SAAS;AACnE,SAAO;AACT;",
+  "names": []
+}